login.microsoftonline.com failing to embed in MS teams

Question

login.microsoftonline.com failing to embed in MS teams

Anonymous

We have an web app that we add MS Teams as a tab. It uses AAD for logging in and the SAML2.0 protocol. When setting it up within our own company, it worked without a hitch, but when we tried to add it to the ecosystem of one of our clients, it fails during the login redirect with: "login.microsoftonline.com not allowed to be embedded". We believe the issue is coming from the X-FRAME-Options: DENY

But it's working within our own ecosystem. I asked our client if they have any kind of custom safe-guards in place that might be driving this behaviour but the answer came back negative. Does anyone know where this option could be added in/ removed from? Browsing the net says that that's not something that can be removed, but it definitely is not present in our own setup.

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2021-12-09T22:20:30.087+00:00

Are you following a specific guide to achieve this?
Anonymous

2021-12-10T08:59:42.053+00:00

Not really. Just implementing the most basic SAML 2.0 SSO set-up. There is no custom code whatsoever. We use Keycloak as our SP and AAD as the IDP.
It works perfectly in the browser, and it also works in our own company teams. It's in our client's where the flow breaks down
when trying to bring up the ogin.microsoftonline.com step. My guess honestly is that either there's something set up
customely in our client's Azure AD environment or there's something disabled in ours. But can't find any kind of reference,
documentation or guides.

1 answer

Your answer

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2021-12-09T22:20:30.087+00:00

Are you following a specific guide to achieve this?
Anonymous

2021-12-10T08:59:42.053+00:00

Not really. Just implementing the most basic SAML 2.0 SSO set-up. There is no custom code whatsoever. We use Keycloak as our SP and AAD as the IDP.
It works perfectly in the browser, and it also works in our own company teams. It's in our client's where the flow breaks down
when trying to bring up the ogin.microsoftonline.com step. My guess honestly is that either there's something set up
customely in our client's Azure AD environment or there's something disabled in ours. But can't find any kind of reference,
documentation or guides.

Answer 1

Marilee Turscak-MSFT 37,206 Microsoft Employee Moderator

I have not encountered this personally, but based on this Stack Overflow thread the "x-frame-options: allow-from" (and Deny) works on some browsers but not others. It doesn't work on Firefox or Chrome, for example. The customer might need to create a custom header that sends the correct data. It's better to use the Content-Security-Policy because it is supported on all browsers now. It could be that you and your customer are using different browsers, or that like you said this is only present in their environment.

I've also reached out to the product team about your specific error with the "login.microsoftonline.com" setup, and will get back to you as soon as I have a reply.

Anonymous

2021-12-21T10:09:59.887+00:00

@Marilee Turscak-MSFT Thank you for your reply. Where would the customer create a custom header from?
Gkiz 0 Reputation points

2023-03-08T13:12:22.0233333+00:00

as soon as I have a reply

They really take their time

Share via

login.microsoftonline.com failing to embed in MS teams

1 answer

Your answer